I get this question from business stakeholders a lot, and I have tried to solve this problem on my own. I have a potential approach, but I want to challenge my assumptions.
In my mind, it should be trivial to parse an email header to identify a spoofed address by comparing the fields:
- alias: "John Smith"
from
: jsmith@example.comreply-to
: jsmith@example.com, or even, group@example.comReceived
: a server-generated address
100% of the phishing incidents I investigate, there is an obvious mis-match in the 4 fields because the attacker manually specified at least one of the first 3 fields. Any mix of the internal or receiver's corporate domain with external domains is a flag. An alias that looks like an email that does not match the from
and reply-to
is a flag.
But the complexity comes in when the email is:
- part of a chain
- forwarded
- sent to multiple people
- sent from a email managing service
Figuring out which emails are spoofed can become tricky in these cases, but none of the above conditions exist in my investigations. For instance, a spoofed email or phishing attempt has always been an initial contact from a single outside source. Email managing services are known and easy to whitelist
If this continues to be the case, wouldn't it be trivial to identify and alert on spoofed emails? You have two header fields to parse (from
and reply-to
), and their contents are predictable and straightforward enough to create a simple regex to test against the alias and Received
fields.
Am I missing an element in my assumptions?